How we handle your call data
Here is what we do with your business data and your callers' information, and who else touches it.
Encryption in Transit
The site and dashboards are served over HTTPS, and every response carries a Strict-Transport-Security header so browsers keep using HTTPS. Supabase, which stores the data, says customer data moves in transit over TLS.
Encryption at Rest
Call records, transcripts, and account details are stored in Supabase, which states that all customer data is encrypted at rest with AES-256. Google Calendar connection tokens are also encrypted by our own code (AES-256-GCM) before they are saved.
Access Controls
The database service key is used only in server code and is never sent to the browser. The admin dashboard and the customer dashboard use separate sign-in checks.
Infrastructure Providers
VocaDent runs on Supabase, Vercel, Twilio, ElevenLabs, Anthropic, Stripe, Resend, Upstash, and Sentry. Each one publishes its own security or privacy documentation, linked below. The full list of what each one receives is in our Privacy Policy.
Data Retention
There is no automatic deletion schedule today, so call records and transcripts stay in your account. To ask about removing your data, email William at whudd2006@gmail.com. Our Privacy Policy explains how your data is used.
Providers we use
Each link opens that provider's own security or privacy documentation.
Found a security issue?
If you discover a vulnerability in VocaDent, please report it responsibly. We ask that you do not publicly disclose the issue until we have had a reasonable time to investigate and address it.
whudd2006@gmail.com →